From 1bc3516ddb03df035a02922d758696f6c74b412c Mon Sep 17 00:00:00 2001 From: 0thernet Date: Sun, 4 Oct 2026 18:47:09 -0400 Subject: [PATCH] Include forks in the weekly dependency audit coverage check Public forks run the audit too, so the weekly coverage check reports them instead of skipping them. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .github/workflows/dependency-audit-coverage.yml | 2 +- AGENTS.md | 2 +- actions/dependency-audit/README.md | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/dependency-audit-coverage.yml b/.github/workflows/dependency-audit-coverage.yml index 909bc67..90f5c64 100644 --- a/.github/workflows/dependency-audit-coverage.yml +++ b/.github/workflows/dependency-audit-coverage.yml @@ -24,4 +24,4 @@ jobs: - name: Check public repositories env: GH_TOKEN: ${{ github.token }} - run: python3 scripts/sync-dependency-audit.py --check --org hraness --visibility public | tee -a "$GITHUB_STEP_SUMMARY" + run: python3 scripts/sync-dependency-audit.py --check --org hraness --visibility public --include-forks | tee -a "$GITHUB_STEP_SUMMARY" diff --git a/AGENTS.md b/AGENTS.md index 9856399..01eea5d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -22,7 +22,7 @@ - `scripts/ci-cost-lint.py` checks a repository's workflows against the cost rules in the `hraness-ci` block; `.github/workflows/ci-cost-lint.yml` is the reusable workflow that runs it. - `scripts/actions-cost-report.py` summarizes the organization's GitHub billing usage per repository and SKU, the daily net trend, and budget headroom. - `actions/npm-visible/` checks public npm version, archive, tag, and provenance visibility within one deadline; its reference documents inputs, outputs, and failure behavior. -- `actions/dependency-audit/` scans every lockfile in a repository with a pinned OSV-Scanner: pull requests fail only on vulnerabilities they add, and the daily run on `main` keeps one `dependency-audit` issue current. `scripts/sync-dependency-audit.py` checks or installs its workflow from `templates/dependency-audit.yml`, pinned to this repository's newest `vX.Y.Z` tag, in every repository that tracks a lockfile; `.github/workflows/dependency-audit-coverage.yml` runs the check weekly over public repositories, and private ones are checked from a signed-in machine with `--org hraness --visibility private`. +- `actions/dependency-audit/` scans every lockfile in a repository with a pinned OSV-Scanner: pull requests fail only on vulnerabilities they add, and the daily run on `main` keeps one `dependency-audit` issue current. `scripts/sync-dependency-audit.py` checks or installs its workflow from `templates/dependency-audit.yml`, pinned to this repository's newest `vX.Y.Z` tag, in every repository that tracks a lockfile; `.github/workflows/dependency-audit-coverage.yml` runs the check weekly over public repositories, forks included, and private ones are checked from a signed-in machine with `--org hraness --visibility private`. - `BROWSER_AUTOMATION.md` describes browser provisioning, selection, cleanup, and regression evidence. - `scripts/register-browser-policy.py` checks or installs the browser rule in global agent files or selected repository roots, preserving other instructions. Global files cover local sessions; repository files and the Devin personal-cloud plugin make the rule portable. - `plugins/browser-automation/` is a rule-only Devin plugin for account-wide cloud, CLI, and Desktop registration; it carries the same canonical browser rule and no tools, hooks, MCP servers, or dependencies. diff --git a/actions/dependency-audit/README.md b/actions/dependency-audit/README.md index 55b242a..9d64603 100644 --- a/actions/dependency-audit/README.md +++ b/actions/dependency-audit/README.md @@ -82,8 +82,8 @@ abbreviated commit are skipped. `scripts/sync-dependency-audit.py --check` reports, for each repository, whether the workflow is current, outdated, drifted, or missing, with its latest run on `main` and the open tracking issue. `.github/workflows/dependency-audit-coverage.yml` -runs it weekly over public repositories. Check private repositories from a -signed-in machine: +runs it weekly over public repositories, forks included. Check private repositories +from a signed-in machine: ```sh scripts/sync-dependency-audit.py --check --org hraness --visibility private